CVE-2008-3257

CVE-2008-3257 is a critical-severity vulnerability in Bea Weblogic Server with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 84% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-119.

Key facts

• Severity: Critical (CVSS 2.0 base score 10.0)
• EPSS exploit prediction: 84% (100th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Bea Weblogic Server
• Published: 2008-07-22
• Last modified: 2026-06-16

Description

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

Frequently asked questions

What is CVE-2008-3257?

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

How severe is CVE-2008-3257?

CVE-2008-3257 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2008-3257 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 84% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-3257?

CVE-2008-3257 primarily affects Bea Weblogic Server. In total, 72 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2008-3257?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2008-3257 published?

CVE-2008-3257 was published on 2008-07-22 and last updated on 2026-06-16.

References

• http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html
• http://secunia.com/advisories/31146
• http://www.attrition.org/pipermail/vim/2008-July/002035.html
• http://www.attrition.org/pipermail/vim/2008-July/002036.html
• http://www.kb.cert.org/vuls/id/716387
• http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html
• http://www.securityfocus.com/bid/30273
• http://www.securitytracker.com/id?1020520
• http://www.vupen.com/english/advisories/2008/2145/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43885
• https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html
• https://www.exploit-db.com/exploits/6089

Affected products (72)

• cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.0:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.5:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.5.1:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.5.1:sp15:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.5.2:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.5.2:sp1:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:4.5.2:sp2:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp10:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp11:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp12:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp13:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp7:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp8:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:5.1:sp9:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.0:sp6:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*
• cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*

More vulnerabilities in Bea Weblogic Server

• CVE-2007-0417 — Critical (CVSS 10.0): BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1…
• CVE-2003-0640 — Critical (CVSS 10.0): BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to…
• CVE-2001-0098 — Critical (CVSS 10.0): Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long…
• CVE-2000-0681 — Critical (CVSS 10.0): Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long…
• CVE-2000-0684 — Critical (CVSS 10.0): BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile…
• CVE-2000-0685 — Critical (CVSS 10.0): BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to…

All CVEs affecting Bea Weblogic Server →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →